Score and classify legal risks on a severity-times-likelihood matrix, assign GREEN/YELLOW/ORANGE/RED ratings, document findings in structured memos, and determine escalation paths. Use when scoring contract exposure, evaluating deal risk, rating legal issues by severity and probability, deciding whether to involve senior counsel or outside lawyers, or building a legal risk register.
Every legal risk is measured across two independent axes:
Impact Magnitude (consequences if the risk becomes reality):
| Rating | Descriptor | Meaning |
|---|---|---|
| 1 | Trivial | Minimal disruption; no meaningful financial, operational, or reputational consequence. Absorbed within day-to-day operations. |
| 2 | Minor | Contained impact; financial exposure under 1% of the relevant contract or transaction value; brief operational hiccup; no public visibility. |
| 3 | Substantial | Tangible impact; financial exposure in the 1-5% range of relevant value; noticeable operational interference; possibility of limited external attention. |
| 4 | Serious | Major impact; financial exposure between 5-25% of relevant value; significant operational disruption; probable public scrutiny; potential for regulatory interest. |
| 5 | Severe | Existential-level impact; financial exposure exceeding 25% of relevant value; core business operations threatened; material reputational harm; regulatory action anticipated; potential personal exposure for directors and officers. |
Occurrence Probability (how likely the risk is to materialize):
| Rating | Descriptor | Meaning |
|---|---|---|
| 1 | Negligible | Essentially theoretical; no known precedent in comparable situations; would demand extraordinary circumstances. |
| 2 | Low | Conceivable but not anticipated; sparse precedent; requires specific precipitating events. |
| 3 | Moderate | Plausible; some analogous situations have materialized; precipitating conditions are foreseeable. |
| 4 | Elevated | Expected to happen; clear precedent exists; precipitating conditions are commonplace in analogous contexts. |
| 5 | Near Certain | Virtually guaranteed; strong historical pattern; precipitating conditions are already present or imminent. |
Risk Score = Impact Magnitude x Occurrence Probability
| Score Band | Category | Indicator |
|---|---|---|
| 1-4 | Baseline Risk | GREEN |
| 5-9 | Intermediate Risk | YELLOW |
| 10-15 | Elevated Risk | ORANGE |
| 16-25 | Acute Risk | RED |
OCCURRENCE PROBABILITY
Negligible Low Moderate Elevated Near Certain
(1) (2) (3) (4) (5)
IMPACT
Severe (5) | 5 | 10 | 15 | 20 | 25 |
Serious (4) | 4 | 8 | 12 | 16 | 20 |
Substantial(3)| 3 | 6 | 9 | 12 | 15 |
Minor (2) | 2 | 4 | 6 | 8 | 10 |
Trivial (1) | 1 | 2 | 3 | 4 | 5 |
Profile:
Protocol:
Typical scenarios:
Profile:
Protocol:
Typical scenarios:
Profile:
Protocol:
Typical scenarios:
Profile:
Protocol:
Typical scenarios:
Every formal evaluation should follow this structure:
## Legal Risk Evaluation
**Prepared**: [date]
**Analyst**: [name of person conducting the evaluation]
**Subject**: [description of the matter under review]
**Privilege designation**: [Yes/No -- mark as attorney-client privileged where applicable]
### 1. Risk Statement
[Precise, concise articulation of the legal risk]
### 2. Factual Background
[Relevant facts, chronology, and business context]
### 3. Scoring Analysis
#### Impact Magnitude: [1-5] - [Descriptor]
[Supporting rationale including potential financial exposure, operational consequences, and reputational dimensions]
#### Occurrence Probability: [1-5] - [Descriptor]
[Supporting rationale including precedent, triggering conditions, and current circumstances]
#### Composite Score: [Number] - [GREEN/YELLOW/ORANGE/RED]
### 4. Aggravating Factors
[Elements that amplify the risk]
### 5. Countervailing Factors
[Elements that dampen the risk or contain exposure]
### 6. Mitigation Alternatives
| Alternative | Effectiveness | Resource Demand | Recommended? |
|---|---|---|---|
| [Option A] | [High/Med/Low] | [High/Med/Low] | [Yes/No] |
| [Option B] | [High/Med/Low] | [High/Med/Low] | [Yes/No] |
### 7. Recommended Course of Action
[Specific recommendation with supporting rationale]
### 8. Post-Mitigation Risk Level
[Projected risk category after implementing recommended measures]
### 9. Ongoing Monitoring Plan
[Frequency and method of review; conditions that would trigger reassessment]
### 10. Immediate Next Steps
1. [Task - Responsible party - Due date]
2. [Task - Responsible party - Due date]
For entry into the team's centralized risk tracker:
| Field | Content |
|---|---|
| Identifier | Unique tracking code |
| Discovery Date | When the risk first came to light |
| Summary | Brief characterization |
| Domain | Contract / Regulatory / Litigation / IP / Data Privacy / Employment / Corporate / Other |
| Impact Rating | 1-5 with descriptor |
| Probability Rating | 1-5 with descriptor |
| Composite Score | Calculated value |
| Category | GREEN / YELLOW / ORANGE / RED |
| Accountable Person | Individual responsible for monitoring |
| Active Controls | Mitigations currently deployed |
| Disposition | Open / Mitigated / Accepted / Closed |
| Next Review | Scheduled reassessment date |
| Remarks | Supplementary context |
When recommending outside engagement, prompt the user to weigh: